Question

我的网站正在使用facebook作为oauth提供商。用户可以通过我的网站购买东西，所以我想强制他们进行身份验证，即使他们已经与facebook有活跃的会话。

我发现这个link in facebook's api documentation讨论了重新认证，但我无法使用我的mvc应用程序。有人知道这是否可行？

var extra = new Dictionary<string, object>();
extra.Add("auth_type", "reauthenticate");

OAuthWebSecurity.RegisterFacebookClient(
            appId: "**********",
            appSecret: "**********************",
            displayName: "",
            extraData: extra);

Answer 1

找到解决方案。我必须创建自己的客户端，而不是使用OAuthWebSecurity.RegisterFacebookClient

提供的默认客户端

using System;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Linq;
using System.Net;
using System.Web;
using System.Web.Helpers;

namespace Namespace.Helpers
{
    public class MyFacebookClient : DotNetOpenAuth.AspNet.Clients.OAuth2Client
    {
        private const string AuthorizationEP = "https://www.facebook.com/dialog/oauth";
        private const string TokenEP = "https://graph.facebook.com/oauth/access_token";
        private readonly string _appId;
        private readonly string _appSecret;

        public MyFacebookClient(string appId, string appSecret)
            : base("facebook")
        {
            this._appId = appId;
            this._appSecret = appSecret;
        }


        protected override Uri GetServiceLoginUrl(Uri returnUrl)
        {
            return new Uri(
                        AuthorizationEP
                        + "?client_id=" + this._appId
                        + "&redirect_uri=" + HttpUtility.UrlEncode(returnUrl.ToString())
                        + "&scope=email,user_about_me"
                        + "&display=page"
                        + "&auth_type=reauthenticate"
                    );
        }

        protected override IDictionary<string, string> GetUserData(string accessToken)
        {
            WebClient client = new WebClient();
            string content = client.DownloadString(
                "https://graph.facebook.com/me?access_token=" + accessToken
            );
            dynamic data = Json.Decode(content);
            return new Dictionary<string, string> {
                {
                    "id",
                    data.id
                },
                {
                    "name",
                    data.name
                },
                {
                    "photo",
                    "https://graph.facebook.com/" + data.id + "/picture"
                },
                {
                    "email",
                    data.email
                }
            };
        }

        protected override string QueryAccessToken(Uri returnUrl, string authorizationCode)
        {
            WebClient client = new WebClient();
            string content = client.DownloadString(
                TokenEP
                + "?client_id=" + this._appId
                + "&client_secret=" + this._appSecret
                + "&redirect_uri=" + HttpUtility.UrlEncode(returnUrl.ToString())
                + "&code=" + authorizationCode
            );

            NameValueCollection nameValueCollection = HttpUtility.ParseQueryString(content);
            if (nameValueCollection != null)
            {
                string result = nameValueCollection["access_token"];
                return result;
            }
            return null;
        }
    }
}

然后在AuthConfig.cs中......

 OAuthWebSecurity.RegisterClient(
                new MyFacebookClient(
                    appId: "xxxxxxxxxx", 
                    appSecret: "xxxxxxxxxxxxxxxx"),
                "facebook", null
            );

Answer 2

如果您的Facebook身份验证在v2.3成为您可以访问的最低版本（非版本调用获得应用程序可访问的最低版本）时停止工作，请注意此处发生的情况。 API现在返回JSON而不是名称值对，因此您必须通过@Ben Tidman更新上面显示的QueryAccessToken方法

以下是更新后的方法

protected override string QueryAccessToken(Uri returnUrl, string authorizationCode)
        {
            WebClient client = new WebClient();
            string content = client.DownloadString(
                TokenEP
                + "?client_id=" + this._appId
                + "&client_secret=" + this._appSecret
                + "&redirect_uri=" + HttpUtility.UrlEncode(returnUrl.ToString())
                + "&code=" + authorizationCode
            );

            dynamic json = System.Web.Helpers.Json.Decode(content);
            if (json != null)
            {
                string result = json.access_token;
                return result;
            }
            return null;
        }

使用OAuthWebSecurity强制重新进行身份验证

2 个答案: